Hardening AWS Environments and Automating Incident Response for AWS Compromises

Presented at DerbyCon 6.0 Recharge (2016), Sept. 25, 2016, 11 a.m. (50 minutes).

Incident Response procedures differ in the cloud versus when performed in traditional, on-premise, environments. The cloud offers the ability to respond to an incident by programmatically collecting evidence and quarantining instances but with this programmatic ability comes the risk of a compromised API key. The risk of a compromised key can be mitigated but proper configuration and monitoring must be in place. The talk discusses the paradigm of Incident Response in the cloud and introduces tools to automate the collection of forensic evidence of a compromised host. It highlights the need to properly configure an AWS environment and provides a tool to aid the configuration process.

Presenters:

• Andrew Krug
• Alex McCormack

Similar Presentations:

• Black Hat USA 2016 / Hardening AWS Environments and Automating Incident Response for AWS Compromises
• GrrCON 2013 / Cloud Incident Response
• DeepSec 2019 „Internet of Facts and Fears“ / Mastering AWS Pentesting and Methodology